Redirect loop on resource root path / + cookie explosion (p_session_token_s.*) . Non-root paths work though. #387

New Issue

MrUnknownDE · 2026-04-05T17:08:29+02:00

MrUnknownDE commented

2026-04-05 17:08:29 +02:00

Originally created by @Krafman on 1/12/2026

Describe the Bug

When accessing a protected resource at the root path (https://foo.example.com/), Pangolin enters a redirect loop to the auth endpoint and the browser shows ERR_TOO_MANY_REDIRECTS. During the loop, Pangolin repeatedly sets new resource session cookies, resulting in dozens of cookies named p_session_token_s. under the resource domain (foo.example.com).

Accessing a non-root path such as https://foo.example.com/bar_page successfully proxies to the backend service. This suggests the issue is tied specifically to root-path redirect / auto-redirect logic.

Environment

OS Type & Version: Linux oracle-arm1 6.14.0-1010-oracle #10~24.04.1-Ubuntu aarch64
Pangolin Version:1.14.1
Gerbil Version:1.3.0
Traefik Version:3.6.6
Newt Version:1.8.1
Olm Version: (if applicable)

To Reproduce

Configure Pangolin with base domain example.com
Deploy Pangolin at pangolin.example.com
Create a protected resource at foo.example.com routed to a backend service at a newt with 127.0.0.1:port
Visit https://foo.example.com/ and observe a redirect loop to https://pangolin.example.com/auth/resource/?redirect=https://foo.example.com/ and eventually ERR_TOO_MANY_REDIRECTS
Open DevTools → Application → Cookies → https://foo.example.com and observe many cookies named p_session_token_s. being created
Visit https://foo.example.com/whatever and observe that the backend loads successfully

Expected Behavior

Visiting https://foo.example.com/ authenticates once and proxies to the backend without a redirect loop

Only a single resource session cookie should be created

*Originally created by @Krafman on 1/12/2026* ### Describe the Bug When accessing a protected resource at the root path (https://foo.example.com/), Pangolin enters a redirect loop to the auth endpoint and the browser shows` ERR_TOO_MANY_REDIRECTS`. During the loop, Pangolin repeatedly sets new resource session cookies, resulting in dozens of cookies named p_session_token_s.<timestamp> under the resource domain (foo.example.com). Accessing a non-root path such as https://foo.example.com/bar_page successfully proxies to the backend service. This suggests the issue is tied specifically to root-path redirect / auto-redirect logic. <img width="454" height="877" alt="Image" src="https://github.com/user-attachments/assets/ee39258d-4996-4f7d-a16a-2718d7265d36" /> ### Environment - OS Type & Version: Linux oracle-arm1 6.14.0-1010-oracle #10~24.04.1-Ubuntu aarch64 - Pangolin Version:1.14.1 - Gerbil Version:1.3.0 - Traefik Version:3.6.6 - Newt Version:1.8.1 - Olm Version: (if applicable) ### To Reproduce 1. Configure Pangolin with base domain example.com 2. Deploy Pangolin at pangolin.example.com 3. Create a protected resource at foo.example.com routed to a backend service at a newt with 127.0.0.1:port 4. Visit https://foo.example.com/ and observe a redirect loop to https://pangolin.example.com/auth/resource/<uuid>?redirect=https://foo.example.com/ and eventually `ERR_TOO_MANY_REDIRECTS` 5. Open DevTools → Application → Cookies → https://foo.example.com and observe many cookies named p_session_token_s.<timestamp> being created 6. Visit https://foo.example.com/whatever and observe that the backend loads successfully ### Expected Behavior Visiting https://foo.example.com/ authenticates once and proxies to the backend without a redirect loop Only a single resource session cookie should be created

MrUnknownDE added the needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating labels 2026-04-05 17:08:30 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating needs investigating

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#387